[WIP] Firewall role

This pulls in -- and actually fixes! -- the functionality from `genesis/ansible-firewall` for the 0.2 branch. When we bump up to 0.3, we can extract this back out to a separate repo (along with the other roles).

I have a little more testing + tweaking here before I'd deem it ready to merge...